## Summary

The koku-metrics-operator CostManagementMetricsConfig CRD exposes `spec.api_url` as a free-form string with no host allow-list or schema validation. When `spec.authentication.type == token` (the default), the operator reads the cluster-global `openshift-config/pull-secret`, extracts the `cloud.openshift.com` bearer token, and attaches it as `Authorization: Bearer <token>` on an outbound POST to the user-supplied URL. No comparison against the default `https://console.redhat.com` gates credential attachment.

## Impact

A principal with `create`/`update` permission on `costmanagementmetricsconfigs` in the operator namespace can cause the operator to send the cluster's Red Hat Cloud / registry pull-secret bearer token to an arbitrary external or in-cluster endpoint. This credential authenticates the entire cluster to `console.redhat.com` and `registry.redhat.io`.

## Affected Code

- `api/v1beta1/metricsconfig_types.go:249` — `APIURL` field definition (no validation)
- `internal/controller/costmanagementmetricsconfig_controller.go:128,235,258,590` — credential extraction and URL construction
- `internal/crhchttp/http_cloud_dot_redhat.go:94` — bearer token attachment to HTTP request

## Remediation

Reject `token` authentication when `api_url != DefaultAPIURL`. Add a CEL validation rule on the CRD:

```yaml
x-kubernetes-validations:
- rule: "self.authentication.type != 'token' || self.api_url == 'https://console.redhat.com'"
  message: "token authentication is only permitted against https://console.redhat.com"
```

Or implement the check in the reconciler before calling `Upload()`.